@jinn-network/client 0.1.9 → 0.2.0

package/dist/task-creator/environment/adapters.d.ts

@@ -0,0 +1,139 @@
+import { type Eip191EnvironmentAttestationV1, type EnvironmentBuildRecipeV1 } from './contracts.js';
+import type { BuiltEnvironment, EnvironmentArtifactUploader, EnvironmentAttestor, EnvironmentBuilder, EnvironmentImagePublisher, EnvironmentImageScanner, EnvironmentSbomGenerator, PublishedEnvironmentImage } from './interfaces.js';
+export type EnvironmentCommandResult = {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+};
+/** Structured command seam: no adapter constructs a shell command string. */
+export type EnvironmentCommandRunner = (bin: string, args: string[], options?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+}) => Promise<EnvironmentCommandResult>;
+export declare const defaultEnvironmentCommandRunner: EnvironmentCommandRunner;
+export interface TemporaryBuildContext {
+    readonly path: string;
+    /** The builder intentionally permits only its rendered Dockerfile. */
+    writeFile(name: 'Dockerfile', content: string): Promise<void>;
+    dispose(): Promise<void>;
+}
+export interface TemporaryBuildContextFilesystem {
+    create(): Promise<TemporaryBuildContext>;
+}
+export interface IsolatedDockerConfig {
+    readonly path: string;
+    dispose(): Promise<void>;
+}
+export interface IsolatedDockerConfigFilesystem {
+    create(): Promise<IsolatedDockerConfig>;
+}
+export declare const localTemporaryBuildContextFilesystem: TemporaryBuildContextFilesystem;
+/** A fresh empty config prevents buildx from loading ambient registry helpers. */
+export declare const localIsolatedDockerConfigFilesystem: IsolatedDockerConfigFilesystem;
+export interface TemporaryDockerArchive {
+    readonly archivePath: string;
+    readonly metadataPath: string;
+    /** Refuses to load a missing, non-regular, or empty Buildx archive. */
+    assertReady(): Promise<void>;
+    dispose(): Promise<void>;
+}
+export interface TemporaryDockerArchiveFilesystem {
+    create(): Promise<TemporaryDockerArchive>;
+}
+export declare const localTemporaryDockerArchiveFilesystem: TemporaryDockerArchiveFilesystem;
+export type DockerEndpointResolver = () => Promise<string>;
+export type DockerBuildxEnvironmentBuilderOptions = {
+    commandRunner?: EnvironmentCommandRunner;
+    temporaryContexts?: TemporaryBuildContextFilesystem;
+    isolatedDockerConfigs?: IsolatedDockerConfigFilesystem;
+    temporaryArchives?: TemporaryDockerArchiveFilesystem;
+    resolveDockerEndpoint?: DockerEndpointResolver;
+    localImageTag?: (recipe: EnvironmentBuildRecipeV1) => string;
+};
+/**
+ * Builds a local image from a Dockerfile-only context. Source reaches Docker
+ * only through the recipe's digest-pinned Git checkout; this adapter never
+ * accepts registry credentials, build secrets, patches, or a source directory.
+ */
+export declare class DockerBuildxEnvironmentBuilder implements EnvironmentBuilder {
+    private readonly commandRunner;
+    private readonly temporaryContexts;
+    private readonly isolatedDockerConfigs;
+    private readonly temporaryArchives;
+    private readonly resolveDockerEndpoint;
+    private readonly localImageTag;
+    constructor(options?: DockerBuildxEnvironmentBuilderOptions);
+    build(rawRecipe: EnvironmentBuildRecipeV1): Promise<BuiltEnvironment>;
+}
+export type Trivy066SecretScannerOptions = {
+    commandRunner?: EnvironmentCommandRunner;
+};
+/** Local Trivy 0.66.0 secret scan; reports never leave this adapter as CIDs. */
+export declare class Trivy066SecretScanner implements EnvironmentImageScanner {
+    private readonly commandRunner;
+    constructor(options?: Trivy066SecretScannerOptions);
+    scan(image: BuiltEnvironment): Promise<{
+        status: 'pass' | 'fail';
+        report: unknown;
+    }>;
+}
+export type Syft131SpdxSbomGeneratorOptions = {
+    commandRunner?: EnvironmentCommandRunner;
+};
+/** Local Syft 1.31.0 SPDX JSON generation; the caller decides publication. */
+export declare class Syft131SpdxSbomGenerator implements EnvironmentSbomGenerator {
+    private readonly commandRunner;
+    constructor(options?: Syft131SpdxSbomGeneratorOptions);
+    generate(image: BuiltEnvironment): Promise<{
+        document: unknown;
+    }>;
+}
+export type DockerImagePublisherOptions = {
+    commandRunner?: EnvironmentCommandRunner;
+};
+/**
+ * Uses Docker's already-configured credential helper. Authentication never
+ * appears in this API, in build arguments, or in the temporary build context.
+ */
+export declare class DockerImagePublisher implements EnvironmentImagePublisher {
+    private readonly commandRunner;
+    constructor(options?: DockerImagePublisherOptions);
+    publish(input: {
+        image: BuiltEnvironment;
+        repository: string;
+    }): Promise<PublishedEnvironmentImage>;
+}
+export type IpfsEnvironmentArtifactUploaderOptions = {
+    registryUrl: string;
+    uploadJson?: (registryUrl: string, document: unknown) => Promise<string>;
+};
+/** Adapts the existing canonical-JSON IPFS registry upload utility. */
+export declare class IpfsEnvironmentArtifactUploader implements EnvironmentArtifactUploader {
+    private readonly options;
+    private readonly uploadJson;
+    constructor(options: IpfsEnvironmentArtifactUploaderOptions);
+    upload(input: {
+        kind: 'recipe' | 'sbom' | 'environment';
+        document: unknown;
+    }): Promise<{
+        cid: string;
+    }>;
+}
+export type Eip191MessageSigner = {
+    address: string;
+    signMessage(input: {
+        message: string;
+    }): Promise<string>;
+};
+export type Eip191EnvironmentAttestorOptions = {
+    operatorSafe: string;
+    signer: Eip191MessageSigner;
+};
+/** EIP-191 adapter over an injected signer; no private-key environment is read. */
+export declare class Eip191EnvironmentAttestor implements EnvironmentAttestor {
+    private readonly options;
+    constructor(options: Eip191EnvironmentAttestorOptions);
+    attest(input: {
+        environmentHash: `sha256:${string}`;
+    }): Promise<Eip191EnvironmentAttestationV1>;
+}

package/dist/task-creator/environment/adapters.js

@@ -0,0 +1,446 @@
+// SPDX-License-Identifier: Apache-2.0
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { uploadToIpfs } from '../../adapters/mech/ipfs.js';
+import { Eip191EnvironmentAttestationV1Schema, EnvironmentBuildRecipeV1Schema, environmentAttestationMessageV1, } from './contracts.js';
+import { renderDockerfile } from './build.js';
+export const defaultEnvironmentCommandRunner = (bin, args, options) => new Promise((resolve, reject) => {
+    const child = spawn(bin, args, { ...options, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => { stdout += chunk.toString(); });
+    child.stderr?.on('data', (chunk) => { stderr += chunk.toString(); });
+    child.on('error', reject);
+    child.on('close', (code) => resolve({ exitCode: code ?? 1, stdout, stderr }));
+});
+/**
+ * The isolated builder may discover Docker CLI plugins only from these static
+ * system locations. It never inherits an operator's Docker config.
+ */
+const APPROVED_DOCKER_CLI_PLUGIN_DIRECTORIES = [
+    '/usr/local/lib/docker/cli-plugins',
+    '/usr/local/libexec/docker/cli-plugins',
+    '/usr/lib/docker/cli-plugins',
+    '/usr/libexec/docker/cli-plugins',
+    '/Applications/Docker.app/Contents/Resources/cli-plugins',
+];
+export const localTemporaryBuildContextFilesystem = {
+    async create() {
+        const path = await mkdtemp(join(tmpdir(), 'jinn-environment-'));
+        return {
+            path,
+            async writeFile(name, content) {
+                if (name !== 'Dockerfile')
+                    throw new Error('local build context may contain only Dockerfile');
+                await writeFile(join(path, name), content, 'utf8');
+            },
+            async dispose() {
+                await rm(path, { recursive: true, force: true });
+            },
+        };
+    },
+};
+/** A fresh empty config prevents buildx from loading ambient registry helpers. */
+export const localIsolatedDockerConfigFilesystem = {
+    async create() {
+        const path = await mkdtemp(join(tmpdir(), 'jinn-docker-config-'));
+        try {
+            await writeFile(join(path, 'config.json'), JSON.stringify({
+                cliPluginsExtraDirs: APPROVED_DOCKER_CLI_PLUGIN_DIRECTORIES,
+            }), 'utf8');
+        }
+        catch (error) {
+            await rm(path, { recursive: true, force: true });
+            throw error;
+        }
+        return {
+            path,
+            async dispose() {
+                await rm(path, { recursive: true, force: true });
+            },
+        };
+    },
+};
+export const localTemporaryDockerArchiveFilesystem = {
+    async create() {
+        const path = await mkdtemp(join(tmpdir(), 'jinn-docker-archive-'));
+        const archivePath = join(path, 'image.tar');
+        const metadataPath = join(path, 'metadata.json');
+        return {
+            archivePath,
+            metadataPath,
+            async assertReady() {
+                await assertNonEmptyRegularFile(archivePath, 'Docker image archive');
+            },
+            async dispose() {
+                await rm(path, { recursive: true, force: true });
+            },
+        };
+    },
+};
+/**
+ * Builds a local image from a Dockerfile-only context. Source reaches Docker
+ * only through the recipe's digest-pinned Git checkout; this adapter never
+ * accepts registry credentials, build secrets, patches, or a source directory.
+ */
+export class DockerBuildxEnvironmentBuilder {
+    commandRunner;
+    temporaryContexts;
+    isolatedDockerConfigs;
+    temporaryArchives;
+    resolveDockerEndpoint;
+    localImageTag;
+    constructor(options = {}) {
+        this.commandRunner = options.commandRunner ?? defaultEnvironmentCommandRunner;
+        this.temporaryContexts = options.temporaryContexts ?? localTemporaryBuildContextFilesystem;
+        this.isolatedDockerConfigs = options.isolatedDockerConfigs ?? localIsolatedDockerConfigFilesystem;
+        this.temporaryArchives = options.temporaryArchives ?? localTemporaryDockerArchiveFilesystem;
+        this.resolveDockerEndpoint = options.resolveDockerEndpoint ?? (() => resolveActiveDockerEndpoint(this.commandRunner));
+        this.localImageTag = options.localImageTag ?? defaultLocalImageTag;
+    }
+    async build(rawRecipe) {
+        const recipe = EnvironmentBuildRecipeV1Schema.parse(rawRecipe);
+        const localImageTag = this.localImageTag(recipe);
+        assertLocalImageTag(localImageTag);
+        const dockerEndpoint = await this.resolveDockerEndpoint();
+        const dockerConfig = await this.isolatedDockerConfigs.create();
+        let context;
+        let archive;
+        let operationError;
+        const options = { env: isolatedBuildEnvironment(dockerConfig.path, dockerEndpoint) };
+        try {
+            context = await this.temporaryContexts.create();
+            archive = await this.temporaryArchives.create();
+            await context.writeFile('Dockerfile', renderDockerfile(recipe));
+            await requireSuccess(this.commandRunner('docker', [
+                'buildx', 'build', '--platform', 'linux/amd64',
+                '--output', `type=docker,dest=${archive.archivePath}`,
+                '--metadata-file', archive.metadataPath,
+                '--tag', localImageTag,
+                '--file', join(context.path, 'Dockerfile'), context.path,
+            ], options), 'Docker Buildx build');
+            await archive.assertReady();
+            const loaded = await requireSuccess(this.commandRunner('docker', ['image', 'load', '--input', archive.archivePath], options), 'Docker image load');
+            assertDockerImageLoadMatchesTag(loaded.stdout, localImageTag);
+            const inspect = await requireSuccess(this.commandRunner('docker', ['image', 'inspect', localImageTag, '--format', '{{json .}}'], options), 'Docker image inspect');
+            return builtEnvironmentFromInspect(inspect.stdout, localImageTag, recipe);
+        }
+        catch (error) {
+            operationError = error;
+            throw error;
+        }
+        finally {
+            const cleanupError = await disposeAllTemporaryResources(context, archive, dockerConfig);
+            if (cleanupError) {
+                const detail = `temporary Docker build cleanup failed: ${cleanupError.message}`;
+                if (operationError !== undefined) {
+                    throw new Error(`${errorMessage(operationError)}; ${detail}`);
+                }
+                throw new Error(detail);
+            }
+        }
+    }
+}
+/** Local Trivy 0.66.0 secret scan; reports never leave this adapter as CIDs. */
+export class Trivy066SecretScanner {
+    commandRunner;
+    constructor(options = {}) {
+        this.commandRunner = options.commandRunner ?? defaultEnvironmentCommandRunner;
+    }
+    async scan(image) {
+        const localImageId = await verifyCurrentLocalImageBinding(image, this.commandRunner);
+        await requireToolVersion(this.commandRunner, 'trivy', '0.66.0');
+        const result = await requireSuccess(this.commandRunner('trivy', ['image', '--scanners', 'secret', '--format', 'json', '--quiet', localImageId]), 'Trivy scan');
+        const report = parseJsonObject(result.stdout, 'Trivy JSON report');
+        if (!Array.isArray(report.Results))
+            throw new Error('Trivy JSON report must contain a Results array');
+        const foundSecrets = report.Results.some((entry) => {
+            if (!isRecord(entry))
+                throw new Error('Trivy JSON report contains an invalid result');
+            if (entry.Secrets === undefined)
+                return false;
+            if (!Array.isArray(entry.Secrets))
+                throw new Error('Trivy JSON report contains invalid Secrets');
+            return entry.Secrets.length > 0;
+        });
+        return { status: foundSecrets ? 'fail' : 'pass', report };
+    }
+}
+/** Local Syft 1.31.0 SPDX JSON generation; the caller decides publication. */
+export class Syft131SpdxSbomGenerator {
+    commandRunner;
+    constructor(options = {}) {
+        this.commandRunner = options.commandRunner ?? defaultEnvironmentCommandRunner;
+    }
+    async generate(image) {
+        const localImageId = await verifyCurrentLocalImageBinding(image, this.commandRunner);
+        await requireToolVersion(this.commandRunner, 'syft', '1.31.0');
+        const result = await requireSuccess(this.commandRunner('syft', ['scan', localImageId, '--output', 'spdx-json']), 'Syft SPDX generation');
+        const document = parseJsonObject(result.stdout, 'Syft SPDX document');
+        if (typeof document.spdxVersion !== 'string' || !/^SPDX-\d+\.\d+$/.test(document.spdxVersion)) {
+            throw new Error('Syft did not emit an SPDX JSON document');
+        }
+        return { document };
+    }
+}
+/**
+ * Uses Docker's already-configured credential helper. Authentication never
+ * appears in this API, in build arguments, or in the temporary build context.
+ */
+export class DockerImagePublisher {
+    commandRunner;
+    constructor(options = {}) {
+        this.commandRunner = options.commandRunner ?? defaultEnvironmentCommandRunner;
+    }
+    async publish(input) {
+        const localImageId = await verifyCurrentLocalImageBinding(input.image, this.commandRunner);
+        const repository = normalizeRepository(input.repository);
+        const remoteTag = `${repository}:${imageTagSuffix(input.image)}`;
+        await requireSuccess(this.commandRunner('docker', ['tag', localImageId, remoteTag]), 'Docker image tag');
+        const pushed = await requireSuccess(this.commandRunner('docker', ['push', remoteTag]), 'Docker image push');
+        const digest = digestFromDockerPush(pushed.stdout);
+        return { reference: `${repository}@${digest}`, digest };
+    }
+}
+/** Adapts the existing canonical-JSON IPFS registry upload utility. */
+export class IpfsEnvironmentArtifactUploader {
+    options;
+    uploadJson;
+    constructor(options) {
+        this.options = options;
+        if (options.registryUrl.trim() === '')
+            throw new Error('IPFS registry URL is required');
+        this.uploadJson = options.uploadJson ?? uploadToIpfs;
+    }
+    async upload(input) {
+        const cid = await this.uploadJson(this.options.registryUrl, input.document);
+        if (typeof cid !== 'string' || cid.trim() === '')
+            throw new Error(`IPFS ${input.kind} upload returned no CID`);
+        return { cid };
+    }
+}
+/** EIP-191 adapter over an injected signer; no private-key environment is read. */
+export class Eip191EnvironmentAttestor {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async attest(input) {
+        if (!/^sha256:[0-9a-f]{64}$/.test(input.environmentHash)) {
+            throw new Error('environment hash must be a SHA-256 digest');
+        }
+        const signature = await this.options.signer.signMessage({
+            message: environmentAttestationMessageV1(input.environmentHash),
+        });
+        return Eip191EnvironmentAttestationV1Schema.parse({
+            scheme: 'eip191',
+            algo: 'secp256k1',
+            environmentHash: input.environmentHash,
+            operatorSafe: this.options.operatorSafe,
+            signer: this.options.signer.address,
+            signature,
+        });
+    }
+}
+function defaultLocalImageTag(recipe) {
+    const recipeId = recipe.recipeId.toLowerCase().replace(/[^a-z0-9_.-]/g, '-');
+    return `jinn-environment/${recipeId}:${recipe.source.baseCommit.slice(0, 12)}`;
+}
+function assertLocalImageTag(tag) {
+    if (!/^[a-z0-9][a-z0-9._/-]*:[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(tag)) {
+        throw new Error('invalid local Docker image tag');
+    }
+}
+function builtEnvironmentFromInspect(stdout, localImageTag, recipe) {
+    const inspect = parseJsonObject(stdout, 'Docker image inspect');
+    if (inspect.Os !== 'linux' || inspect.Architecture !== 'amd64') {
+        throw new Error('Docker image inspect did not confirm linux/amd64');
+    }
+    if (typeof inspect.Id !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(inspect.Id)) {
+        throw new Error('Docker image inspect did not return an immutable image ID');
+    }
+    const localImageDigest = digestFromRepoDigests(inspect.RepoDigests);
+    return {
+        localImageTag,
+        localImageId: inspect.Id,
+        ...(localImageDigest ? { localImageDigest } : {}),
+        platform: 'linux/amd64',
+        workspace: '/testbed',
+        smoke: { status: 'pass', commands: recipe.smokeCommands },
+    };
+}
+function digestFromRepoDigests(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value))
+        throw new Error('Docker image inspect returned invalid RepoDigests');
+    for (const entry of value) {
+        if (typeof entry !== 'string')
+            throw new Error('Docker image inspect returned invalid RepoDigests');
+        const match = /@(sha256:[0-9a-f]{64})$/.exec(entry);
+        if (match)
+            return match[1];
+    }
+    return undefined;
+}
+async function resolveActiveDockerEndpoint(commandRunner) {
+    const explicitEndpoint = process.env['DOCKER_HOST']?.trim();
+    if (explicitEndpoint)
+        return normalizeDockerEndpoint(explicitEndpoint);
+    const context = await requireSuccess(commandRunner('docker', ['context', 'inspect', '--format', '{{json .Endpoints.docker.Host}}']), 'Docker context inspect');
+    const output = context.stdout.trim();
+    let endpoint = output;
+    try {
+        endpoint = JSON.parse(output);
+    }
+    catch {
+        // Older Docker CLIs can return a raw formatted scalar.
+    }
+    if (typeof endpoint !== 'string')
+        throw new Error('Docker context inspect did not return a daemon endpoint');
+    return normalizeDockerEndpoint(endpoint);
+}
+function normalizeDockerEndpoint(value) {
+    const endpoint = value.trim();
+    if (!/^(?:unix|npipe|tcp|ssh):\/\/[^\s]+$/.test(endpoint)) {
+        throw new Error('Docker daemon endpoint is invalid');
+    }
+    return endpoint;
+}
+function isolatedBuildEnvironment(dockerConfigPath, dockerEndpoint) {
+    const environment = {
+        DOCKER_CONFIG: dockerConfigPath,
+        HOME: dockerConfigPath,
+        DOCKER_HOST: dockerEndpoint,
+    };
+    for (const key of ['PATH', 'TMPDIR', 'TMP', 'TEMP', 'SSL_CERT_FILE', 'SSL_CERT_DIR']) {
+        const value = process.env[key];
+        if (value !== undefined)
+            environment[key] = value;
+    }
+    return environment;
+}
+function assertDockerImageLoadMatchesTag(stdout, expectedTag) {
+    const loadedTags = [...stdout.matchAll(/^Loaded image:\s*(.+)\s*$/gm)].map((match) => match[1].trim());
+    if (loadedTags.length !== 1 || loadedTags[0] !== expectedTag) {
+        throw new Error(`Docker image load did not load expected tag ${expectedTag}`);
+    }
+}
+async function assertNonEmptyRegularFile(path, description) {
+    let details;
+    try {
+        details = await stat(path);
+    }
+    catch {
+        throw new Error(`${description} is missing or empty`);
+    }
+    if (!details.isFile() || details.size === 0)
+        throw new Error(`${description} is missing or empty`);
+}
+async function disposeAllTemporaryResources(context, archive, dockerConfig) {
+    const failures = [];
+    for (const [name, resource] of [
+        ['build context', context],
+        ['image archive', archive],
+        ['Docker config', dockerConfig],
+    ]) {
+        if (!resource)
+            continue;
+        try {
+            await resource.dispose();
+        }
+        catch (error) {
+            failures.push(`${name}: ${errorMessage(error)}`);
+        }
+    }
+    return failures.length === 0 ? undefined : new Error(failures.join('; '));
+}
+async function verifyCurrentLocalImageBinding(image, commandRunner) {
+    const localImageId = immutableLocalImageId(image);
+    assertBuiltEnvironment(image);
+    const inspected = await requireSuccess(commandRunner('docker', ['image', 'inspect', image.localImageTag, '--format', '{{json .}}']), 'Docker image binding inspect');
+    const current = parseJsonObject(inspected.stdout, 'Docker image binding inspect');
+    if (current.Os !== 'linux' || current.Architecture !== 'amd64') {
+        throw new Error('Docker image binding inspect did not confirm linux/amd64');
+    }
+    if (current.Id !== localImageId) {
+        throw new Error('Docker image binding inspect does not match immutable local image ID');
+    }
+    return localImageId;
+}
+function immutableLocalImageId(image) {
+    if (!image.localImageId || !/^sha256:[0-9a-f]{64}$/.test(image.localImageId)) {
+        throw new Error('local environment requires an immutable local image ID');
+    }
+    return image.localImageId;
+}
+function assertBuiltEnvironment(image) {
+    if (image.platform !== 'linux/amd64' || image.workspace !== '/testbed' || image.smoke.status !== 'pass' ||
+        image.localImageTag.trim() === '') {
+        throw new Error('local environment image is not a verified linux/amd64 build');
+    }
+    immutableLocalImageId(image);
+}
+async function requireToolVersion(commandRunner, tool, expectedVersion) {
+    const version = await requireSuccess(commandRunner(tool, ['--version']), `${tool} version`);
+    const pattern = new RegExp(`(?:^|\\s|:)${escapeRegex(expectedVersion)}(?:\\s|$)`);
+    if (!pattern.test(version.stdout))
+        throw new Error(`${tool} must be version ${expectedVersion}`);
+}
+async function requireSuccess(result, operation) {
+    let completed;
+    try {
+        completed = await result;
+    }
+    catch (error) {
+        throw new Error(`${operation} failed to start: ${errorMessage(error)}`);
+    }
+    if (completed.exitCode !== 0) {
+        throw new Error(`${operation} failed (exit ${completed.exitCode}): ${completed.stderr.trim()}`);
+    }
+    return completed;
+}
+function parseJsonObject(stdout, description) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        throw new Error(`${description} was not valid JSON`);
+    }
+    if (!isRecord(parsed))
+        throw new Error(`${description} must be an object`);
+    return parsed;
+}
+function normalizeRepository(repository) {
+    const normalized = repository.trim().replace(/\/+$/, '');
+    if (normalized === '' || /\s|@/.test(normalized))
+        throw new Error('invalid target image repository');
+    return normalized;
+}
+function imageTagSuffix(image) {
+    const digest = image.localImageId ?? image.localImageDigest;
+    if (!digest || !/^sha256:[0-9a-f]{64}$/.test(digest)) {
+        throw new Error('Docker publisher requires an immutable local image ID or digest');
+    }
+    return digest.slice('sha256:'.length, 'sha256:'.length + 12);
+}
+function digestFromDockerPush(stdout) {
+    const matches = [...stdout.matchAll(/\bdigest:\s*(sha256:[0-9a-f]{64})\b/g)];
+    const digest = matches.at(-1)?.[1];
+    if (!digest)
+        throw new Error('Docker image push did not report a digest');
+    return digest;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=adapters.js.map

package/dist/task-creator/environment/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../../src/task-creator/environment/adapters.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EACL,oCAAoC,EACpC,8BAA8B,EAC9B,+BAA+B,GAGhC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAyB9C,MAAM,CAAC,MAAM,+BAA+B,GAA6B,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC/H,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAsBH;;;GAGG;AACH,MAAM,sCAAsC,GAAG;IAC7C,mCAAmC;IACnC,uCAAuC;IACvC,6BAA6B;IAC7B,iCAAiC;IACjC,yDAAyD;CACjD,CAAC;AAEX,MAAM,CAAC,MAAM,oCAAoC,GAAoC;IACnF,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAChE,OAAO;YACL,IAAI;YACJ,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO;gBAC3B,IAAI,IAAI,KAAK,YAAY;oBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBAC9F,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YACD,KAAK,CAAC,OAAO;gBACX,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,mCAAmC,GAAmC;IACjF,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxD,mBAAmB,EAAE,sCAAsC;aAC5D,CAAC,EAAE,MAAM,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI;YACJ,KAAK,CAAC,OAAO;gBACX,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAcF,MAAM,CAAC,MAAM,qCAAqC,GAAqC;IACrF,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACjD,OAAO;YACL,WAAW;YACX,YAAY;YACZ,KAAK,CAAC,WAAW;gBACf,MAAM,yBAAyB,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;YACvE,CAAC;YACD,KAAK,CAAC,OAAO;gBACX,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAaF;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IACxB,aAAa,CAA2B;IACxC,iBAAiB,CAAkC;IACnD,qBAAqB,CAAiC;IACtD,iBAAiB,CAAmC;IACpD,qBAAqB,CAAyB;IAC9C,aAAa,CAA+C;IAE7E,YAAY,UAAiD,EAAE;QAC7D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,+BAA+B,CAAC;QAC9E,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,oCAAoC,CAAC;QAC3F,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,mCAAmC,CAAC;QAClG,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,qCAAqC,CAAC;QAC5F,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACtH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAmC;QAC7C,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjD,mBAAmB,CAAC,aAAa,CAAC,CAAC;QACnC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;QAC/D,IAAI,OAA0C,CAAC;QAC/C,IAAI,OAA2C,CAAC;QAChD,IAAI,cAAuB,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,MAAM,cAAc,CAClB,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE;gBAC3B,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa;gBAC9C,UAAU,EAAE,oBAAoB,OAAO,CAAC,WAAW,EAAE;gBACrD,iBAAiB,EAAE,OAAO,CAAC,YAAY;gBACvC,OAAO,EAAE,aAAa;gBACtB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,IAAI;aACzD,EAAE,OAAO,CAAC,EACX,qBAAqB,CACtB,CAAC;YACF,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,EACxF,mBAAmB,CACpB,CAAC;YACF,+BAA+B,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,EACpG,sBAAsB,CACvB,CAAC;YACF,OAAO,2BAA2B,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YACxF,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,0CAA0C,YAAY,CAAC,OAAO,EAAE,CAAC;gBAChF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,CAAC,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAID,gFAAgF;AAChF,MAAM,OAAO,qBAAqB;IACf,aAAa,CAA2B;IAEzD,YAAY,UAAwC,EAAE;QACpD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,+BAA+B,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAuB;QAChC,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACrF,MAAM,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,EAC3G,YAAY,CACb,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtG,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACtF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5D,CAAC;CACF;AAID,8EAA8E;AAC9E,MAAM,OAAO,wBAAwB;IAClB,aAAa,CAA2B;IAEzD,YAAY,UAA2C,EAAE;QACvD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,+BAA+B,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACrF,MAAM,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,EAC3E,sBAAsB,CACvB,CAAC;QACF,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QACtE,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;CACF;AAID;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IACd,aAAa,CAA2B;IAEzD,YAAY,UAAuC,EAAE;QACnD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,+BAA+B,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAsD;QAClE,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,GAAG,UAAU,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,IAAI,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;IAC1D,CAAC;CACF;AAOD,uEAAuE;AACvE,MAAM,OAAO,+BAA+B;IAGb;IAFZ,UAAU,CAA8D;IAEzF,YAA6B,OAA+C;QAA/C,YAAO,GAAP,OAAO,CAAwC;QAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAqE;QAChF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,yBAAyB,CAAC,CAAC;QAC/G,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;CACF;AAYD,mFAAmF;AACnF,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,OAAyC;QAAzC,YAAO,GAAP,OAAO,CAAkC;IAAG,CAAC;IAE1E,KAAK,CAAC,MAAM,CAAC,KAA8C;QACzD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YACtD,OAAO,EAAE,+BAA+B,CAAC,KAAK,CAAC,eAAe,CAAC;SAChE,CAAC,CAAC;QACH,OAAO,oCAAoC,CAAC,KAAK,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,WAAW;YACjB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;YACnC,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,MAAgC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC7E,OAAO,oBAAoB,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,MAAc,EACd,aAAqB,EACrB,MAAgC;IAEhC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpE,OAAO;QACL,aAAa;QACb,YAAY,EAAE,OAAO,CAAC,EAAwB;QAC9C,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,QAAQ,EAAE,aAAa;QACvB,SAAS,EAAE,UAAU;QACrB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAChG,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAwB,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,aAAuC;IAChF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,gBAAgB;QAAE,OAAO,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,aAAa,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,iCAAiC,CAAC,CAAC,EAC9F,wBAAwB,CACzB,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,QAAQ,GAAY,MAAM,CAAC;IAC/B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7G,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,gBAAwB,EAAE,cAAsB;IAChF,MAAM,WAAW,GAAsB;QACrC,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,cAAc;KAC5B,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,CAAU,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,+BAA+B,CAAC,MAAc,EAAE,WAAmB;IAC1E,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACxG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,+CAA+C,WAAW,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,WAAmB;IACxE,IAAI,OAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,sBAAsB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,sBAAsB,CAAC,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,OAA0C,EAC1C,OAA2C,EAC3C,YAAkC;IAElC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI;QAC7B,CAAC,eAAe,EAAE,OAAO,CAAC;QAC1B,CAAC,eAAe,EAAE,OAAO,CAAC;QAC1B,CAAC,eAAe,EAAE,YAAY,CAAC;KACvB,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAAuB,EACvB,aAAuC;IAEvC,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAClD,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,cAAc,CACpC,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,EAC5F,8BAA8B,CAC/B,CAAC;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAuB;IACpD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,YAAY,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAuB;IACrD,IACE,KAAK,CAAC,QAAQ,KAAK,aAAa,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM;QACnG,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,qBAAqB,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,aAAuC,EACvC,IAAY,EACZ,eAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,eAAe,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAyC,EAAE,SAAiB;IACxF,IAAI,SAAmC,CAAC;IACxC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qBAAqB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,iBAAiB,SAAS,CAAC,QAAQ,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,WAAmB;IAC1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,qBAAqB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,oBAAoB,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,UAAU,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAuB;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,gBAAgB,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC1E,OAAO,MAA4B,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/task-creator/environment/build.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Renders the complete, self-contained Buildx build plan. Source is fetched
+ * directly by Git; the Docker build context contains only this Dockerfile.
+ */
+export declare function renderDockerfile(input: unknown): string;